CVE-2021-41325

Опубликовано: 30 сент. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.)

Ссылки

https://charonv.net/Pydio-Broken-Access-Control/
Third Party Advisory
https://github.com/pydio/cells/releases/tag/v2.2.12
Release Notes
Third Party Advisory
https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212
Product
Vendor Advisory
https://charonv.net/Pydio-Broken-Access-Control/
Third Party Advisory
https://github.com/pydio/cells/releases/tag/v2.2.12
Release Notes
Third Party Advisory
https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:pydio:cells:2.2.9:*:*:*:-:*:*:*

cpe:2.3:a:pydio:cells:2.2.9:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 43%

0.00209

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-3frq-wgwx-p958